Google Launches Gemini 3.8 Flash & Flash Cyber: What’s New

Can Gemini 3.8 Flash make coding agents better at completing complex engineering tasks rather than simply generating more code?

Google introduced Gemini 3.8 Flash and Gemini 3.8 Flash Cyber on September 2, 2026, just three weeks after Gemini 3.7 Flash. Instead of increasing the model’s context window or adding an entirely new toolset, Google has concentrated this release on software engineering, autonomous agents, multi-step reasoning, and more reliable execution across longer tasks.

Gemini 3.8 Flash Cyber takes the same foundational intelligence into a separate defensive-security environment focused on vulnerability discovery and remediation.

Why Gemini 3.8 Flash Matters for Software Teams

Google describes Gemini 3.8 Flash as its most intelligent Flash model, engineered for long-horizon software engineering, autonomous agents, and complex workflows. The stable gemini-3.8-flash model is generally available and ready for production use.

From a developer perspective, its core technical profile is:

Google also supports caching, URL context, Google Maps grounding, Batch API, Flex inference, and Priority inference for the model.

The Upgrade Is About Execution, Not a Bigger Context Window

Gemini 3.8 Flash is based on Gemini 3.7 Flash and retains a 1M-token context window and 64K maximum output. Google instead describes the new model as advancing performance across software engineering and agentic knowledge workflows.

That distinction matters.

The model already had access to a large context window and a broad toolset. Gemini 3.8 Flash is mainly about using those capabilities more effectively when the task requires:

• Several dependent reasoning steps: later decisions may depend on information discovered earlier in the workflow

• Repeated tool interaction: completing a task may require multiple searches, executions, or validations rather than one function call

• Longer execution: the model may need to keep working after the first change instead of ending with an initial answer

• Recovery from failures: unsuccessful commands, tests, or intermediate results need to influence what the model does next

For coding agents, this makes execution quality more important than simply measuring how much code the model can place inside its context window.

How Gemini 3.8 Flash Improves Coding-Agent Workflows

Traditional code generation is relatively straightforward: provide a prompt and receive code. Agentic software engineering is harder.

A coding agent may need to inspect an unfamiliar repository, understand dependencies, choose an implementation strategy, edit multiple files, execute commands, evaluate test failures, revise its approach, and verify that the final result actually works.

Google says Gemini 3.8 Flash is designed to be more reliable across these longer workflows.

Multi-Step Reasoning & Iterative Tool Use

For difficult multi-step goals, Google says Gemini 3.8 Flash can take smaller reasoning steps, call tools iteratively, and verify its work along the way. Google also reports reductions in failed loops and errors in autonomous-agent workflows.

For development work, that can matter when an agent needs to:

• Investigate before modifying code: The agent can gather evidence about a failure or dependency instead of immediately generating a speculative patch

• Use several tools sequentially: Repository search, file inspection, command execution, testing, and additional analysis may all be required within one task

• Use intermediate results: A failed test or unexpected output can become input to the model’s next decision

• Replan after roadblocks: The agent can change direction when its initial approach does not work

• Stay active across longer tasks: Complex engineering goals are less likely to be reduced to a single generate-and-stop interaction

This moves the coding workflow closer to: 

inspect → reason → modify → execute → validate → adjust 

rather than: 

prompt → generate → stop

Long-Horizon Software Engineering & Multi-File Refactoring

Google specifically identifies long-horizon software engineering, complex multi-file refactoring, and deterministic tool execution as areas of improvement in Gemini 3.8 Flash.

Those improvements are relevant to tasks such as:

• Multi-file implementation: A feature may require coordinated modifications across interfaces, services, tests, configuration, and supporting modules

• Large refactoring tasks: The model needs to preserve existing behavior while changing code structure across connected files

• Debugging: Useful debugging requires more than generating a likely fix; the agent must investigate evidence, form a hypothesis, modify the code, and test it

• Agentic implementation: Planning, coding, executing tools, and validating results can happen within the same extended workflow

Google DeepMind’s demonstrations also show Gemini 3.8 Flash completing looping coding tasks in Google Antigravity and building interactive applications through Google AI Studio.

Gemini 3.8 Flash: Benchmarks & Pricing

Google evaluates Gemini 3.8 Flash across software engineering, agent workflows, knowledge work, computer use, long context, multimodal capabilities, and scientific reasoning. The clearest developer-facing improvement is in long-horizon software engineering.

On DeepSWE v1.1, Google says Gemini 3.8 Flash outperforms most larger frontier models at a fraction of their cost when autonomously solving complex engineering problems end to end.

The model also improves on several complex reasoning and agent-oriented evaluations:

Google DeepMind reports that Gemini 3.8 Flash leads 3.7 Flash on these evaluations, with HLE-Verified measuring reasoning across STEM, humanities, and professional fields.

How to Interpret Gemini 3.8 Flash Coding Benchmarks

Public benchmarks can show that model capability is moving in the right direction, but production software teams need additional metrics.

A coding agent should also be evaluated on:

• Task completion rate: Did the model finish the full engineering request rather than producing only a plausible partial solution?

• First-pass accuracy: How much correction was required before the implementation became usable?

• Change precision: Did it modify only the necessary parts of the codebase?

• Test success: Did the generated implementation satisfy existing tests and acceptance criteria?

• Tool efficiency: How many searches, command executions, file reads, and retries were required?

• Human intervention: At what point did an engineer have to rescue or redirect the agent?

• Context consumption: How much input was required to establish enough repository understanding to start useful work?

• Cost per completed task: What did the entire successful engineering workflow cost after reasoning, tools, retries, and verification?

These measures help distinguish a model that performs well on an isolated benchmark from one that is genuinely more useful inside an engineering workflow.

Google also cautions that its model evaluations span different methodologies, while its model card notes that foundation-model limitations such as hallucinations, occasional slowness, timeouts, and increased token usage at higher effort levels still apply.

Gemini 3.8 Flash Pricing & Cost per Coding Task

Gemini 3.8 Flash launched at the same introductory standard API price as Gemini 3.7 Flash. Google will increase those rates at the start of 2027.

Google specifies that thinking tokens are included in output-token billing.

Where Gemini 3.8 Flash Cyber Fits Into Software Engineering

Gemini 3.8 Flash Cyber is Google’s specialized defensive cybersecurity variant of the Gemini 3.8 model.

Google says both models share the same foundational intelligence, but Flash Cyber is configured for a different deployment environment and uses a more permissive set of cybersecurity mitigations. Because those capabilities can be dual-use, access is limited to trusted defenders through Google’s Fairwind Program.

Google describes Flash Cyber as its most capable cybersecurity model, with a particular focus on two development-related problems:

• Vulnerability discovery: identifying security weaknesses in software.

• Vulnerability remediation: generating fixes for the vulnerabilities that have been found.

Gemini 3.8 Flash Cyber Vulnerability Discovery Performance

Google evaluates Flash Cyber using both standardized external benchmarks and broader internal codebase testing.

On CyberGym, an industry benchmark for autonomous vulnerability discovery:

• Gemini 3.8 Flash Cyber: 86.2% Pass@1

• Gemini 3.5 Flash Cyber: 77.5% Pass@1

• Improvement: 8.7 percentage points.

Pass@1 indicates whether a task is solved successfully in a single sampled attempt, making it useful for understanding first-attempt reliability.

CyberGym is heavily focused on C/C++, so Google also created a broader internal vulnerability benchmark. According to Google:

• the evaluation uses complex real-world codebases;

• testing spans 20 programming languages;

• it covers a wider range of vulnerabilities; and

• Gemini 3.8 Flash Cyber achieved a success rate above 70%.

The combination is important. CyberGym provides a standardized comparison, while Google’s multilingual evaluation tests whether the model’s vulnerability-discovery capability extends beyond the environments most heavily represented in that benchmark.

Gemini 3.8 Flash Cyber Vulnerability Patching

Finding vulnerable code does not complete a defensive-security workflow.

A useful security system must also help determine how the weakness can be corrected without breaking the intended functionality of the software.

Google says it deliberately invested in vulnerability fixing for Gemini 3.8 Flash Cyber and prioritized defensive remediation over offensive capabilities such as exploitation.

On CWE-Bench, an external patching benchmark run by Collinear:

• Gemini 3.8 Flash Cyber achieved 47.2% Pass@1.

• Google cites 47.8% for the leading frontier model in the comparison.

• Google places Flash Cyber on the benchmark’s Pareto frontier, combining near-leading patching performance with substantially lower cost.

This benchmark tests something different from vulnerability discovery: whether the model can move from understanding the security problem toward generating an effective remediation.

What Google Reports From Real Security Environments

Google has also published results from internal and partner-specific security evaluations:

• Chrome Security: Gemini 3.8 Flash Cyber generated 2.6× more correct vulnerability patches than the best larger commercial models tested by the team.

• Wiz: Flash Cyber achieved 7.5%–9.7% higher recall on Wiz’s internal penetration-testing benchmark while operating at 2.3–5.2× lower cost than other leading frontier models evaluated.

• Google Cloud Vulnerability Research: Google says the model helped identify a critical foundational vulnerability in less than two hours, for a class of research and discovery that would usually take months.

These results should not be treated as directly interchangeable benchmark scores.

CyberGym and CWE-Bench are standardized external evaluations, while Chrome, Wiz, and Google Cloud represent internal or organization-specific environments. Together, however, they provide evidence across different stages of the defensive software-security workflow.

Conclusion

Gemini 3.8 Flash is less about increasing raw model capacity and more about making that capacity useful across longer, more complicated workflows.

For developers, the most relevant improvements are:

• stronger long-horizon software engineering

• more persistent multi-step reasoning

• iterative tool orchestration

• better recovery during agent workflows

• configurable reasoning effort for balancing quality, latency, and token consumption

Gemini 3.8 Flash Cyber extends the same underlying intelligence into defensive software security, where Google reports strong performance across both vulnerability discovery and vulnerability remediation.

The practical question for engineering teams is therefore not whether Gemini 3.8 Flash has a better benchmark score in isolation. It is whether those improvements produce more correct completed tasks, fewer failed loops, less human intervention, and an acceptable cost per successful engineering outcome inside the team’s actual development environment.

FAQs

What is Gemini 3.8 Flash?

Gemini 3.8 Flash is Google’s most intelligent Flash model, designed for long-horizon software engineering, autonomous agents, complex workflows, and multi-step reasoning while retaining Flash-level speed and efficiency.

When was Gemini 3.8 Flash released?

Google released Gemini 3.8 Flash on September 2, 2026. The stable gemini-3.8-flash model is generally available through the Gemini API.

What is Gemini 3.8 Flash Cyber?

Gemini 3.8 Flash Cyber is Google’s specialized cybersecurity model, built on the same foundational intelligence as Gemini 3.8 Flash but optimized for defensive tasks such as vulnerability discovery and patching.

When was Gemini 3.8 Flash Cyber released?

Google introduced Gemini 3.8 Flash Cyber on September 2, 2026, alongside Gemini 3.8 Flash and the launch of its Fairwind Program for trusted defenders.

Is Gemini 3.8 Flash Available?

Gemini 3.8 Flash is generally available (GA). Google provides the stable gemini-3.8-flash model for production use, with no shutdown date currently announced.

Is Gemini 3.8 Flash Cyber Available?

Gemini 3.8 Flash Cyber is not generally available. Access is restricted to approved trusted defenders through Google DeepMind’s Fairwind Program, which applies governance and due-diligence requirements to participating organizations.

Where Can I Access Gemini 3.8 Flash?

Developers can access Gemini 3.8 Flash through the Gemini API, Google AI Studio, Android Studio, Google Antigravity, and Stitch. Google also offers it through Gemini Enterprise and to eligible consumers (Google AI Pro and Ultra subscribers) across the Gemini app, AI Mode in Google Search, and Gemini in Google Sheets.

Where Can I Access Gemini 3.8 Flash Cyber?

Gemini 3.8 Flash Cyber is available through the Fairwind Program to approved trusted partners. Eligible organizations can use it as a standalone model or together with Google DeepMind’s CodeMender for vulnerability research and patching workflows.

External References -

1. Google - Gemini 3.8 Flash Cyber Real-World Results

2. Google - Gemini 3.8 Flash Cyber Vulnerability Discovery

3. Google DeepMind - Fairwind Program

4. Google AI for Developers - Gemini API Pricing

5. Google DeepMind - Gemini 3.8 Flash Performance

6. Google DeepMind - Gemini 3.8 Flash

7. Google AI for Developers

8. Google DeepMind - Gemini 3.8 Flash Model Card